Analysis

  • max time kernel
    107s
  • max time network
    99s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    17-11-2020 11:51

General

  • Target

    323bf86aeeab08e1388d51cffc172f53.exe

  • Size

    207KB

  • MD5

    4d579e8f4ac5748665b0bf0cfa19fbf4

  • SHA1

    79a45e2170bfb5840fbb7ba0b5ee37f1f2393899

  • SHA256

    f3d77292e6ac34f5f42189840d21e61647cf4919f259a37e7a5bfea1dd236795

  • SHA512

    43dfa7199da5f4028432af0e411b63298a55402a76906fd1f144796db49d0f2e4c845a8d47db31107775aa1228fc4b2825cb780f5b0a56862fc37a14fa2bc72a

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\323bf86aeeab08e1388d51cffc172f53.exe
    "C:\Users\Admin\AppData\Local\Temp\323bf86aeeab08e1388d51cffc172f53.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1876
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c schtasks /create /F /sc minute /mo 1 /tn "\WindowsAppPool\AppPool" /tr "C:\Users\Admin\AppData\Local\Temp\KEDgJAei.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:548
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /F /sc minute /mo 1 /tn "\WindowsAppPool\AppPool" /tr "C:\Users\Admin\AppData\Local\Temp\KEDgJAei.exe"
        3⤵
        • Creates scheduled task(s)
        PID:1028
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {0B136589-92A8-4414-AE56-FA7B56F7A24A} S-1-5-21-293278959-2699126792-324916226-1000:TUICJFPF\Admin:Interactive:[1]
    1⤵
      PID:616

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/548-3-0x0000000000000000-mapping.dmp
    • memory/1028-4-0x0000000000000000-mapping.dmp
    • memory/1308-2-0x000007FEF7F80000-0x000007FEF81FA000-memory.dmp
      Filesize

      2.5MB

    • memory/1876-0-0x000000000067B000-0x000000000067C000-memory.dmp
      Filesize

      4KB

    • memory/1876-1-0x0000000001E80000-0x0000000001E91000-memory.dmp
      Filesize

      68KB